Skip to content
SPECIFICTION
Get listed

Horusec

github.com

Free plan WebWindowsmacOSLinuxAPISelf-hosted
Visit github.com
Spec score 8.1 #7 of 26 in UML Modeling Software

What it is

Horusec is a static code analysis tool for identifying security flaws during development. It scans source code and searches project files and Git history for leaked keys and other security issues. The project describes analyzing 18 languages with 20 security tools; listed coverage includes C#, Java, Kotlin, Python, Ruby, Golang, Terraform, JavaScript, TypeScript, Kubernetes, PHP, C, HTML, JSON, Dart, Elixir, Shell, and Nginx. Analysis is configurable through CLI resources. Developers can use its command-line interface, while DevSecOps teams can add it to CI/CD pipelines; a Visual Studio Code extension is also provided. Horusec-Web offers vulnerability dashboards, false-positive controls, authorization tokens, and vulnerability updates. Horusec Platform integrates with the CLI to visualize and manage vulnerabilities, and supports native Horusec, LDAP, and Keycloak authentication. Its repository was archived by its owner on March 19, 2025 and is read-only. Running Horusec with all its tools requires Docker; the platform requires RabbitMQ and PostgreSQL. The open-source plan is free under Apache License 2.0.

Spec sheet

Purpose
Horusec performs static code analysis to identify security flaws during development.Read 1 Oct 2026 · github.com
Support
Questions and ideas are handled through GitHub Issues and the Zup Open Source Forum.Read 1 Oct 2026 · github.com
Configurable analysis
The analysis is fully configurable through CLI resources.Read 1 Oct 2026 · github.com
Developer workflow
Developers can use Horusec through its CLI, while DevSecOps teams can use it in CI/CD pipelines.Read 1 Oct 2026 · github.com
Docker requirement
Docker is required to run Horusec with all its tools; disabling Docker loses much of the analysis power.Read 1 Oct 2026 · github.com
Editor integration
The project provides a Visual Studio Code extension for analyzing projects.Read 1 Oct 2026 · github.com
Languages
It analyzes C#, Java, Kotlin, Python, Ruby, Golang, Terraform, JavaScript, TypeScript, Kubernetes, PHP, C, HTML, JSON, Dart, Elixir, Shell and Nginx.Read 1 Oct 2026 · github.com
Platform authentication
Horusec Platform supports native Horusec, LDAP and Keycloak authentication.Read 1 Oct 2026 · github.com
Platform dependencies
Horusec Platform requires RabbitMQ and PostgreSQL.Read 1 Oct 2026 · github.com
Platform integration
Horusec Platform is a set of web services integrating with Horusec CLI to visualize and manage vulnerabilities.Read 1 Oct 2026 · github.com
Platform status
The Horusec Platform repository was archived by its owner on March 19, 2025 and is read-only.Read 1 Oct 2026 · github.com
Secret detection
It searches project files and Git history for key leaks and other security flaws.Read 1 Oct 2026 · github.com
Security policy
Zup's open-source projects adopt OpenSSF Security Scorecard and OpenSSF Best Practices Badge recommendations.Read 1 Oct 2026 · github.com
Security tools
Horusec analyzes 18 languages with 20 different security tools simultaneously.Read 1 Oct 2026 · github.com
Web application
Horusec-Web provides vulnerability metrics dashboards, false-positive control, authorization tokens and vulnerability updates.Read 1 Oct 2026 · github.com

Plans and prices

Open source Free Apache License 2.0 · CLI and platform components Read 1 Oct 2026 · github.com

Every Horusec plan and price →

Strong points and limits

Strong points

  • Free under Apache License 2.0.
  • Scans source files and Git history for leaked keys.
  • Supports CI/CD and a Visual Studio Code extension.
  • Analysis uses 20 security tools, per the project.
  • Includes vulnerability dashboards and false-positive controls.

Limits

  • Full tool analysis requires Docker.
  • The platform requires RabbitMQ and PostgreSQL.
  • Horusec Platform repository is archived and read-only.

Who it suits

Horusec suits developers and DevSecOps teams that want configurable security analysis in development or CI/CD workflows. Teams considering the web platform should account for its dependencies and archived, read-only repository.

Verdict

Horusec offers command-line and editor workflows for code security analysis, with a web platform for managing findings. Docker is needed for its full set of tools, and the archived platform repository is a notable limitation.

Where Specifiction places it

Alternatives to HorusecAll alternatives →